Continuously remediate non-compliant resources
In a cloud environment, continuously detecting and remediating non-compliant resources is essential for ensuring security, compliance, and cost-efficiency. Alibaba Cloud provides products such as Cloud Governance Center and CloudConfig to support the administration of the resource lifecycle. Using automated scanning and remediation, enterprises can:
Detect non-compliant resources in real time, such as unencrypted OSS buckets and RDS instances with public network access enabled.
Automate remediation, such as automatically disabling public network access.
Implement unified, cross-account administration to ensure configuration consistency across a multi-account environment.
Priority
Medium
Discouraged practices
Relying on manual inspections, which cannot track real-time changes. This leads to delays in detecting newly created non-compliant resources, such as ECS instances with port 22 open.
Recording non-compliant states without performing automated remediation. This delays security event responses, allows non-compliant resources to persist, and increases the attack surface.
Failing to centrally manage resource compliance in a multi-account architecture. This results in compliance audits that do not cover all resources across the organization.
Implementation guide
Perform continuous threat scanning.
Use Cloud Governance Center for continuous detection. Cloud Governance Center provides comprehensive administration maturity assessments based on the design principles and best practices of the Cloud Adoption Framework. It covers more than 260 check items and uses real-time Alibaba Cloud data to automatically detect potential threats in your cloud environment. For more information, see Administration maturity assessment. You can also subscribe to administration reports to regularly receive the latest assessment results for your cloud environment. This helps you promptly view and address threats. For more information, see Subscribe to administration reports.
You can use Cloud Config to continuously detect non-compliant resources.
A compliance package is a collection of rules customized for specific compliance scenarios in CloudConfig. You can use compliance packages to quickly create compliance rules and assess your cloud resources based on these scenarios. For a list of compliance packages provided by Alibaba Cloud, see Compliance package templates.
You can create compliance rules to determine whether the configuration item of a resource is compliant. For an introduction to rules, see Definition and working principle of rules. In addition to using the rule templates provided by Alibaba Cloud, you can use services such as Function Compute to customize the detection logic for rules. For example, enterprises that use ECS hosts often require that system vulnerabilities on ECS instances are fixed promptly to prevent security attacks. They also need to maintain consistent system and software configuration baselines, such as host kernel parameters, host time zones, and software versions. Therefore, you can use Function Compute to customize compliance rules that check the data plane of hosts. For more information, see Use CloudConfig and Function Compute to scan for cloud host threats.
Centrally collect and analyze resource non-compliance events. Use the delivery feature of CloudConfig to deliver resource non-compliance events to a specified OSS bucket or SLS Logstore. In a multi-account architecture, you can refer to the solution in Unified compliance audit for multi-account configurations to aggregate resource events from all enterprise accounts into your security or audit account. This enables centralized, continuous monitoring of compliance for all business resources.
Develop remediation measures.
For some threat items identified in the Cloud Governance Center administration maturity assessment results, you can use the quick fix feature to remediate them with a single click. For more information, see Quickly fix threat items. For check items that do not support quick fixes, Cloud Governance Center provides an assisted decision-making feature. This feature offers more detailed, multi-dimensional resource data to help you determine an administration policy.
For resources that are evaluated as non-compliant by CloudConfig rules, you can use the remediation feature provided by CloudConfig. When a rule detects a non-compliant resource, it can automatically execute a remediation to correct the non-compliant configuration. This ensures that your cloud IT system achieves autonomous and continuous compliance. For more information, see Remediation settings.